CVE-2026-88772
published 2026-09-27CVE-2026-88772: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and…
PriorityP193high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-30
Exploited in the wild
EPSS
78.16%
99.6th percentile
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| citrix | citrix_adm | — | — |
| citrix | citrix_endpoint_management | — | — |
| citrix | citrix_hypervisor | — | — |
| citrix | citrix_netscaler_adc | — | — |
| citrix | citrix_netscaler_gateway | — | — |
| citrix | citrix_virtual_apps_and_desktops | — | — |
| citrix | citrix_workspace_app | — | — |
| citrix | endpoint_management | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_application_delivery_controller | >= 13.1 < 13.1-64.23 | 13.1-64.23 |
| citrix | netscaler_application_delivery_controller | >= 13.1 < 13.1.37.279 | 13.1.37.279 |
| citrix | netscaler_application_delivery_controller | >= 14.1 < 14.1-73.37 | 14.1-73.37 |
| citrix | netscaler_application_delivery_controller | 14.1-66.68 – 14.1-73.37 | — |
| citrix | netscaler_gateway | — | — |
| citrix | netscaler_gateway | >= 13.1 < 13.1-64.23 | 13.1-64.23 |
| citrix | netscaler_gateway | >= 14.1 < 14.1-73.37 | 14.1-73.37 |
| citrix | xenmobile | — | — |
| citrix | xenserver | — | — |
| citrix_netscaler | adc | < 14.1-73.37 | 14.1-73.37 |
| citrix_netscaler | adc | < 13.1-64.23 | 13.1-64.23 |
| citrix_netscaler | adc | < 14.1-73.37 FIPS | 14.1-73.37 FIPS |
| citrix_netscaler | adc | < 13.1.37.279 FIPS and NDcPP | 13.1.37.279 FIPS and NDcPP |
| citrix_netscaler | gateway | < 14.1-73.37 | 14.1-73.37 |
| citrix_netscaler | gateway | < 13.1-64.23 | 13.1-64.23 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.5CRITICAL
cisa9.5CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
ghsa_unreviewed·2026-09-27
CVE-2026-88772 [CRITICAL] CWE-119 Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
VulDB
Citrix NetScaler ADC/NetScaler Gateway code injection (EUVD-2026-87959 / Nessus ID 350844)
vuldb·2026-09-27·CVSS 9.5
CVE-2026-88772 [CRITICAL] Citrix NetScaler ADC/NetScaler Gateway code injection (EUVD-2026-87959 / Nessus ID 350844)
A vulnerability labeled as very critical has been found in Citrix NetScaler ADC and NetScaler Gateway. Impacted is an unknown function. The manipulation results in code injection.
This vulnerability is known as CVE-2026-88772. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The affected component should be upgraded.
VulnCheck
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
vulncheck·2026·CVSS 9.5
CVE-2026-88772 [CRITICAL] CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Affected: Citrix NetScaler ADC and NetScaler Gateway
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's intern
CISA
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
cisa·2026-09-27·CVSS 9.5
CVE-2026-88772 [CRITICAL] CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Vulnerability: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Affected: Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure
CISA
Citrix NetScaler Improper Input Validation Vulnerability
cisa·2026-09-27·CVSS 9.5
CVE-2026-88771 [CRITICAL] CWE-119 Citrix NetScaler Improper Input Validation Vulnerability
Vulnerability: Citrix NetScaler Improper Input Validation Vulnerability
Affected: Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: Running the pro
Citrix
Citrix Security Bulletin CTX697174
vendor_citrix·CVSS 8.8
CVE-2026-19489 [HIGH] Citrix Security Bulletin CTX697174
Citrix Security Bulletin CTX697174
CVE References: CVE-2026-19489, CVE-2026-19490, CVE-2026-78546, CVE-2026-78547, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace app, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697181
vendor_citrix·CVSS 6.5
CVE-2026-102700 [MEDIUM] Citrix Security Bulletin CTX697181
Citrix Security Bulletin CTX697181
CVE References: CVE-2026-102700, CVE-2026-102701, CVE-2026-107406, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-84419, CVE-2026-84420, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace App, Endpoint Management, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697187
vendor_citrix·CVSS 6.5
CVE-2026-102700 [MEDIUM] Citrix Security Bulletin CTX697187
Citrix Security Bulletin CTX697187
CVE References: CVE-2026-102700, CVE-2026-102701, CVE-2026-107406, CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-84419, CVE-2026-84420, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-88779
Affected Products: Citrix ADM, Citrix Endpoint Management, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace App, Endpoint Management, XenMobile, XenServer
Citrix
Citrix Security Bulletin CTX697096
vendor_citrix·CVSS 8.8
CVE-2026-19489 [HIGH] Citrix Security Bulletin CTX697096
Citrix Security Bulletin CTX697096
CVE References: CVE-2026-19489, CVE-2026-19490, CVE-2026-42491, CVE-2026-78546, CVE-2026-78547, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix Virtual Apps and Desktops, Citrix Workspace app, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
No detection rules found.
No public exploits indexed.
Unit42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
blogs_unit42·2026-10-21
CVE-2026-109618 Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
## Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
Unit 42
Published: October 21, 2026
High Profile Threats
Vulnerabilities
CVE-2026-109618
CVE-2026-109619
## Executive Summary
Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance .
PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately.
Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken its website offline as a precaution.
Palo Alto Network
Recorded Future
September 2026 CVE Landscape
blogs_recorded_future·2026-10-13·CVSS 9.8
CVE-2026-88771 [CRITICAL] September 2026 CVE Landscape
## September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and m
Hackernews
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
blogs_hackernews·2026-10-05·CVSS 7.5
CVE-2026-88779 [HIGH] New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks.
The vulnerability, tracked as CVE-2026-88779 , carries a CVSS score of 8.7 out of 10.0.
"CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions," Citrix said . "The issue affects customer-managed NetScaler deployments running affected supported versio
Checkpoint
5th October – Threat Intelligence Report
blogs_checkpoint·2026-10-05
CVE-2026-88771 5th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 5th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link. Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participan
Hackernews
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
blogs_hackernews·2026-10-02·CVSS 9.8
CVE-2026-104286 [CRITICAL] Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
"An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL chara
Hackernews
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
blogs_hackernews·2026-10-01·CVSS 9.8
CVE-2026-88771 [CRITICAL] Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data.
LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler authentication events containing attacker-controlled usernames designed to weaponize CVE-2026-88771.
CVE-2026-88771 (CVSS score: 9.5) is an imprope
Hackernews
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
blogs_hackernews·2026-09-30·CVSS 8.1
CVE-2026-88772 [HIGH] Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler Packet Processing Engine (NSPPE).
"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds o
Hackernews
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
blogs_hackernews·2026-09-30·CVSS 9.8
CVE-2026-88772 [CRITICAL] Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe.
The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional services sectors.
In a post shared on LinkedIn, Charles Carmakal, chief technology officer at Mandiant Consulting, said the targeted intrusions have impacte
Rapid7
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
blogs_rapid7·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
## Overview
On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772 . Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure .
CVE-2026-88771 affects vulnerable NetScaler deployments in their default configuration, with no additional product features required. The vendor has also indicated that the attack complexity for exploiting CVE-2026-88771 is low, meaning reliable RCE is likely against all vulnerable NetScaler appliances regardless of their configuration. This is especially concerning due to the pr
Hackernews
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerabilities are listed below -
CVE-2026-88771 (CVSS score: 9.5) - An improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
CVE-2026-88772 (CVSS score: 9.5) - An improper restriction of operations within the bounds of a memory buffer vulnerability th
Unit42
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
blogs_unit42·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
## Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Unit 42
Published: September 28, 2026
High Profile Threats
Vulnerabilities
Citrix Netscaler
Denial of service
Remote Code Execution
Zero-day
## Executive Summary
Unit 42 is aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. As of Sept. 27, 2026, Palo Alto Networks Cortex Xpanse has identified 50,277 exposed instances that could potentially be vulnerable to these CVEs based on our telemetry.
CVE-2026-88771 is a remote code execution (RCE) vulnerability that fails to properly validate input and allows an unauthenticated actor to run commands against NetScaler ADC and NetScaler Gateway syst
Hackernews
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
## ⚡ Threat of the Week
Citrix
Hackernews
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
blogs_hackernews·2026-09-27·CVSS 9.5
CVE-2026-88771 [CRITICAL] Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six other flaws. One of the two affects every deployment on an affected version, including those in the default configuration.
The bulletin came a day after security firm watchTowr said two unpatched NetScaler RCE flaws had been exploited, and after some administrators said they had taken appliances offline. Citrix did not say whether i
Tenable
Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
blogs_tenable·2026-09-27·CVSS 9.5
CVE-2026-88771 [CRITICAL] Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
## Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
CVE-2026-88771 and CVE-2026-88772, two zero-day vulnerabilities in Citrix NetScaler, have been confirmed as exploited in the wild. Citrix released patches on September 27, 2026.
## Change log
Update September 27: Citrix published security bulletin CTX697096, confirming CVE-2026-88771 and CVE-2026-88772 as the two zero-day RCE vulnerabilities and releasing patches. Post updated with CVE IDs, CVSS scores, patch versions, and IoC guidance.
Update September 27: Citrix published security bulletin CTX697096, confirming CVE-2026-88771 and CVE-2026-88772 as the two zero-day RCE vulnerabilities and releasing patches. Post updated with CVE IDs, CVSS scores, patch versions, and IoC guidance.
September 27: Orig
NCSC
Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
ncsc·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
News Download & print article PDF Download & print article PDF
## Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway
The NCSC is urging UK organisations to promptly mitigate vulnerabilities affecting Citrix NetScaler ADC and Gateway, two of which are being actively exploited.
## What has happened?
Citrix has published a security bulletin detailing eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of these, CVE-2026-88771 and CVE-2026-88772, have been confirmed as being actively exploited.
The NCSC is working to understand the impact of these vulnerabilities on UK organisations.
- CVE-2026-88771: Improper input validation allowing an unauthenticated remote attacker to execute arbitrary commands.
- CVE-2026-88
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772
2026-09-27
Published
2026-09-27
Added to CISA KEV
Exploited in the wild